LogScale · CQL

CQL Knowledge Base

Ready-to-use CQL queries for threat hunting, detection, and SOC triage. Copy, filter, and search in seconds.

151 queries8 categories
Powered bySofistic·created bydarkreitor
K
20 queries
NEW
PAID

System Process with Unauthorized Parent — Hidden Process Hunting

Detects critical Windows processes (svchost, lsass, services, winlogon, csrss, wininit) running from unusual parent processes. A key post-compromise threat hunting technique to identify process injection or masquerading used by advanced actors to hide malware within the system process tree.

#repo="base_sensor" #event_simpleName=ProcessRollup2
| FileName=/(?i)(svchost\.exe|lsass\.exe|services\.exe|winlogon\.exe|csrss\.exe|wininit\.exe)/
| not ParentBaseFileName=/(?i)(services\.exe|wininit\.exe|smss\.exe|lsass\.exe|winlogon\.exe|ntoskrnl\.exe)/
Threat Huntinghidden-processprocess-injection
Advanced
NEW
PAID

Remote Authentication Spike per Account — Lateral Movement Detection

Detects accounts with more than 8 remote authentications within a 30-minute window, a pattern indicative of automated lateral movement or active use of compromised credentials for host pivoting. Aligned with Falcon Identity Threat Protection capabilities for detecting identity abuse and lateral movement in corporate environments.

#repo="base_sensor" #event_simpleName=UserLogon
| LogonType=/^(3|10)$/
| groupBy([UserName, RemoteAddressIP4, ComputerName], function=[count(as=logon_count), min(@timestamp, as=first_seen), max(@timestamp, as=last_seen)])
Identitylateral-movementcredential-abuse
Advanced
NEW
FREE

Registry Run Key Modification for Persistence

Detects writes to Windows Run, RunOnce, and Winlogon registry keys, the most widely used persistence mechanism employed by malware to execute automatically at system startup. Essential for basic post-compromise triage during Incident Response to identify residual persistence artifacts per CrowdStrike best practices.

#repo="base_sensor" #event_simpleName=RegGenericValueUpdate
| RegKeyPath=/(?i)(Software\\Microsoft\\Windows\\CurrentVersion\\Run|Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce|Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon)/
| groupBy([ComputerName, UserName, RegKeyPath, RegValueName, RegStringValue], function=count())
Persistenceregistryrun-key
Beginner
NEW
FREE

Scheduled Task Creation with schtasks.exe for Persistence

Detects the use of schtasks.exe to create or modify scheduled tasks, a basic persistence mechanism widely used by malware and attackers to maintain access across system reboots. Essential for basic host triage during Incident Response to identify residual persistence artifacts on compromised endpoints.

#repo="base_sensor" #event_simpleName=ProcessRollup2
| FileName=/(?i)schtasks\.exe/
| CommandLine=/(?i)(\/create|\/sc|\/tr|\/tn)/
Persistencescheduled-taskpersistence
Beginner
NEW
PAID

Kernel Driver Loaded from Non-Standard Path — BYOVD Attack

Detects the loading of kernel drivers (.sys) from non-standard paths such as Temp, AppData, or ProgramData. The BYOVD (Bring Your Own Vulnerable Driver) technique enables escalation to kernel level and EDR evasion, particularly relevant given the landscape of critical Windows driver vulnerabilities documented in 2025.

#repo="base_sensor" #event_simpleName=DriverLoad
| ImageFileName=/(?i)\.sys$/
| ImageFileName=/(?i)(\\temp\\|\\tmp\\|\\appdata\\|\\programdata\\|users\\public|\\downloads\\)/
EDRbyovdvulnerable-driver
Intermediate
NEW
PAID

APT3 Multi-Stage CMD Reconnaissance Chain Detection

Detects sequences of reconnaissance commands executed via cmd.exe consistent with APT3 operator TTPs — chains of whoami, net user/group, nltest, ipconfig, and systeminfo from the same user on the same host, indicative of hands-on-keyboard activity post-compromise

#repo="base_sensor" #event_simpleName=ProcessRollup2
| FileName=/(?i)cmd\.exe/
| CommandLine=/(?i)(whoami|net\s+(user|group|localgroup)|nltest|ipconfig|systeminfo|tasklist|netstat|arp|quser)/
Threat Huntingapt3cmd-recon
Advanced
NEW
PAID

BYOVD: Kernel Driver Loaded from Non-Standard User Path

Detects the Bring Your Own Vulnerable Driver (BYOVD) attack by identifying kernel driver loads from paths accessible to unprivileged users. A technique documented in the Windows Privilege Escalation 2025 report for escalating to kernel level, disabling EDR including Falcon, and implanting rootkits. Legitimate OS drivers are never loaded from Temp, AppData, or Downloads.

#repo="base_sensor" #event_simpleName=DriverLoad
| ImageFileName=/(?i)(\\Temp\\|\\AppData\\|\\Users\\|\\Downloads\\|\\ProgramData\\)/
| groupBy([ComputerName, ImageFileName, MD5HashData, SHA256HashData], function=count())
Persistencebyovdkernel-driver
Advanced
NEW
PAID

ClickFix Initial Access: LOLBINs Spawned from Web Browser

Detects the ClickFix pattern where popular browsers spawn script interpreters or LOLBIN binaries with suspicious arguments. An active initial access technique used by the LeakNet ransomware group: the user pastes malicious clipboard commands believing they are following legitimate support or CAPTCHA instructions.

#repo="base_sensor" #event_simpleName=ProcessRollup2
| ParentBaseFileName=/(?i)(chrome\.exe|msedge\.exe|firefox\.exe|iexplore\.exe|brave\.exe|opera\.exe)/
| FileName=/(?i)(mshta\.exe|wscript\.exe|cscript\.exe|powershell\.exe|pwsh\.exe|cmd\.exe|regsvr32\.exe|rundll32\.exe)/
Malwareclickfixinitial-access
Advanced
NEW
PAID

ClickFix: Browser-Spawned Scripting Engine for Initial Access

Detects the ClickFix social engineering initial access technique used by LeakNet and other ransomware actors, where attackers use fake browser prompts to trick users into running clipboard-copied commands. Flags scripting engines spawned directly from major web browsers — a high-confidence indicator of clipboard-hijack campaigns

#repo="base_sensor" #event_simpleName=ProcessRollup2
| ParentBaseFileName=/(?i)(chrome\.exe|msedge\.exe|firefox\.exe|iexplore\.exe|opera\.exe|brave\.exe)/
| FileName=/(?i)(mshta\.exe|wscript\.exe|cscript\.exe|powershell\.exe|cmd\.exe)/
Malwareclickfixinitial-access
Intermediate
NEW
PAID

Cloud CDR: IAM Privilege Escalation — High-Risk API Operations

Detects sequences of high-risk cloud API calls used in IAM privilege escalation across AWS, Azure, and GCP. Aligned with CrowdStrike Real-Time Cloud Detection & Response capabilities announced in April 2026. Covers the standard cloud attacker playbook: role creation with modified trust relationships, permanent access key generation, attaching permissive policies, and adding users to privileged groups.

#repo="base_sensor" #event_simpleName=CloudApiActivity
| ActionName=/(?i)(CreateRole|AttachRolePolicy|PutUserPolicy|CreateAccessKey|AddUserToGroup|UpdateAssumeRolePolicy|CreateLoginProfile|SetDefaultPolicyVersion|PassRole)/
| groupBy([UserName, SourceIPAddress, CloudProvider, ActionName], function=count())
Cloudcloudiam
Intermediate
NEW
PAID

Deno Runtime Abused as Malware Loader (LeakNet TTP)

Detects suspicious execution of the Deno JavaScript runtime outside developer contexts, matching the LeakNet ransomware gang technique of using the open-source Deno runtime as a malware loader for initial access. Flags Deno processes spawned from non-developer parents with execution or network permission flags

#repo="base_sensor" #event_simpleName=ProcessRollup2
| FileName=/(?i)deno\.exe/
| CommandLine=/(?i)(run|eval|--allow-net|--allow-read|--allow-write|--allow-all|-A\b)/
Malwaredenoleaknet
Advanced
NEW
PAID

Deno Runtime as Malware Loader: LeakNet Ransomware Campaign

Detects abuse of the Deno runtime (open-source Node.js alternative) as a malware loading platform, a technique documented in the active LeakNet ransomware campaign. Deno executes remote code with granular permission flags that bypass PowerShell and wscript-based controls. Its presence on corporate endpoints is inherently anomalous.

#repo="base_sensor" #event_simpleName=ProcessRollup2
| FileName=/(?i)deno(\.exe)?$/
| CommandLine=/(?i)(--allow-all|--allow-net|--allow-read|--allow-write|--allow-run|deno eval|deno run http)/
Malwaredenomalware-loader
Intermediate
NEW
FREE

Executable Launched from Windows Temp Directory

Detects processes executing from Windows temporary directories — a common indicator of malware droppers, ransomware payload staging, and post-exploitation download-and-execute patterns. Beginner-friendly detection query for initial triage of suspicious execution paths, covering AppData Temp, Windows Temp, and root Temp locations

#repo="base_sensor" #event_simpleName=ProcessRollup2
| ImageFileName=/(?i)(\\Temp\\|\\AppData\\Local\\Temp\\|\\Windows\\Temp\\)/
| not ImageFileName=/(?i)(MsiExec|setup\.exe|install\.exe|update\.exe|deploy)/
Malwaretemp-directorymalware-staging
Beginner
NEW
PAID

Web Exploitation: Anomalous Child Process from IIS Worker Process w3wp.exe

Detects deserialization exploitation in ASP.NET applications through anomalous child processes launched by w3wp.exe. Covers CVE-2025-53690 Sitecore ViewState, RCE in React Server Components via Flight protocol, and critical vulnerabilities in Fortra GoAnywhere MFT. High-fidelity indicator: w3wp.exe should never spawn shells or reconnaissance tools in production.

#repo="base_sensor" #event_simpleName=ProcessRollup2
| ParentBaseFileName=/(?i)w3wp\.exe/
| FileName=/(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|certutil\.exe|bitsadmin\.exe|regsvr32\.exe|rundll32\.exe|net\.exe|whoami\.exe|systeminfo\.exe|curl\.exe|wget\.exe)/
Vulnerabilityiisdeserialization
Advanced
NEW
FREE

Basic Detection: PowerShell Executed with EncodedCommand Parameter

Fundamental detection query that identifies PowerShell executions with the -EncodedCommand parameter or its abbreviation -enc. A basic but consistent indicator of malicious obfuscation present in most modern ransomware campaigns (LeakNet/ClickFix) and in post-exploitation stages of critical 2025 vulnerabilities. Ideal as a first query for analysts new to CrowdStrike LogScale.

#repo="base_sensor" #event_simpleName=ProcessRollup2
| FileName=/(?i)powershell(\.exe)?$/
| CommandLine=/(?i)(-EncodedCommand|-enc\b)/
EDRpowershellencoded-command
Beginner
NEW
FREE

Whoami Execution by Any Parent Process

Basic detection of whoami.exe execution across all endpoints — one of the most common post-compromise enumeration commands used by attackers to identify current user context after initial access. Ideal for beginner threat hunters and SOC analysts building a baseline of identity enumeration activity in LogScale

#repo="base_sensor" #event_simpleName=ProcessRollup2
| FileName=/(?i)whoami\.exe/
| groupBy([ComputerName, UserName, ParentBaseFileName], function=count(as=whoami_count))
EDRwhoamienumeration
Beginner
NEW
PAID

WMI-Spawned Command Shell for APT Lateral Movement

Detects cmd.exe or PowerShell processes spawned by WmiPrvSE.exe and executing reconnaissance, enumeration, or persistence commands — a high-confidence APT lateral movement indicator. WMI-spawned shells running enumeration commands are a persistent hallmark of hands-on-keyboard operators including APT3 and other nation-state actors

#repo="base_sensor" #event_simpleName=ProcessRollup2
| ParentBaseFileName=/(?i)WmiPrvSE\.exe/
| FileName=/(?i)(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe)/
Persistencewmilateral-movement
Intermediate
NEW
PAID

ALPHV BlackCat Ransomware - Windows Defender Disablement via PowerShell and Registry

Detects PowerShell and service control commands used by ALPHV BlackCat ransomware operators to disable Windows Defender and related AV services before deploying ransomware payload, consistent with pre-encryption TTPs documented in the DOJ BlackCat disruption case where two operators pleaded guilty to targeting multiple U.S. victims

#repo="base_sensor" #event_simpleName=ProcessRollup2
| FileName=/(?i)(powershell\.exe|reg\.exe|sc\.exe)/
| CommandLine=/(?i)(Set-MpPreference.*-Disable|DisableAntiSpyware|DisableRealtimeMonitoring|DisableBehaviorMonitoring|DisableBlockAtFirstSeen|ForceDefenderPassiveMode|sc\s+config\s+WinDefend\s+start|Set-MpPreference.*ExclusionPath)/
Malwarealphvblackcat
Advanced
NEW
PAID

APT Network Discovery Sequence — 5 or More Tools Within 30-Minute Window

Identifies hosts running 5 or more distinct network reconnaissance binaries (ping, nslookup, nltest, arp, route, netstat, ipconfig, tracert) within a 30-minute window. This multi-tool burst pattern is a high-fidelity indicator of hands-on-keyboard APT operators performing internal network mapping after initial compromise, consistent with APT TTPs analyzed in Azeria Labs and CrowdStrike threat intelligence reporting.

#repo="base_sensor" #event_simpleName=ProcessRollup2
| FileName=/(?i)(net\.exe|net1\.exe|ping\.exe|nslookup\.exe|nltest\.exe|arp\.exe|route\.exe|netstat\.exe|ipconfig\.exe|tracert\.exe|nbtstat\.exe)/
| groupBy([ComputerName, UserName], function=[count(as=recon_total), count(FileName, distinct=true, as=unique_tools), collect(FileName, limit=20), min(@timestamp, as=first_seen), max(@timestamp, as=last_seen)])
Threat Huntingaptnetwork-discovery
Advanced
NEW
PAID

APT3 Multi-Stage Windows Command Shell Reconnaissance Chain

Detects hosts where cmd.exe or PowerShell execute 3 or more inline reconnaissance commands (whoami, hostname, net, systeminfo, nltest) within a session. A high-fidelity hands-on-keyboard indicator attributed to APT3 and similar threat actors documented in CrowdStrike Falcon IR investigations.

#repo="base_sensor" #event_simpleName=ProcessRollup2
| FileName=/(?i)(cmd\.exe|powershell\.exe)/
| CommandLine=/(?i)(\/[cC]\s+(whoami|hostname|ipconfig|net\s+(user|group|localgroup|view)|nltest|systeminfo|tasklist|netstat|arp|nslookup|dsquery|quser))/
Threat Huntingapt3cmd-shell
Advanced